I've received completely legit emails from Chase Bank that used URLs that, on first glance, had to be fake. I followed up using alternate channels and found out that it wasn't a scam just poorly executed "security".